Guests discuss the journey towards deep trust in Zero Trust, building a culture of security awareness in product companies, meeting security requirements, and the intersection of compliance and security. They emphasize the importance of multiple layers of trust and the role of security practitioners in guiding the business.
Zero Trust requires multiple layers of authentication to establish trust and verify known entities.
Security in the Zero Trust framework should extend beyond perimeter-based approaches and focus on internal networks, user authentication, and component-based trust.
Deep dives
Introduction to the Podcast Episode
In this podcast episode of Adopting Zero Trust, hosts Elliot Volkmann and Neil Dennis introduce the concept of Zero Trust and its importance in cybersecurity. They share their journey of building a secure infrastructure and bringing together a group of experts at a conference to discuss Zero Trust. The episode focuses on three guests: Daniel Morashlian, co-founder and CTO of Dreda, Ties Bono, CSO for Vercel, and Matt Hillary, CSO for Dreda. The hosts emphasize the significance of trust, authentication, and establishing known entities in the Zero Trust framework.
Zero Trust: Trust but Verify
The guests provide their insights on Zero Trust. Ties Bono highlights the concept of trust but verify, emphasizing the importance of multiple layers of authentication to establish trust. Daniel Morashlian explains Zero Trust as the process of establishing trust between entities that may not know each other initially, drawing parallels with real-life scenarios like verifying someone's identity. Matt Hillary discusses how the perception of trust has evolved over time, from perimeter-focused security to the realization that internal networks and user authentication are equally important. They also touch on the importance of continuously evaluating and improving trust mechanisms.
Security Layers and Deep Trust
The conversation shifts to the significance of security layers within the Zero Trust framework. The guests emphasize that security should go beyond perimeter-based approaches and extend to internal networks, user authentication, and component-based trust. They discuss the benefits of breaking down components for better trust management and how foundational security layers can be built upon over time. The hosts and guests stress the need for a risk-based approach, continuous improvement, and the integration of security into the cultural fabric of organizations.
The Intersection of Compliance and Security
The episode delves into the relationship between compliance and security in the Zero Trust context. The guests highlight that compliance and security should not be seen as opposing forces but rather as interconnected aspects. They emphasize that compliance frameworks provide a foundation for building a security program, and security enhancements often improve compliance. The conversation also touches upon the importance of transparency, automation, and cultural adoption of security practices within organizations.
Over the past two years, we’ve explored the ins and outs of Zero Trust, ranging from the concept as a strategy down to the more technical components, such as how it impacts the physical world as found in IoT devices. However, what is often missed in these conversations, is at what point an organization can actually build trust.
Not just crawling up from the baseline of zero but achieving continuous trust. The short answer? Defense in depth, building security in layers, and ensuring every 1 and 0 is secure at the offset while continuously monitored through automation.
And this is where we get to introduce this week’s guests, who were kind enough to be pulled away from a busy conference. This is also a special episode for us, too, as it’s the first in-person interview we’ve done since launching this series. Live (June 22, 2023) from Drataverse, we have Daniel Marashlian, the co-founder and CTO of Drata, Ty Sbano, the CISO for Vercel and an angel investor at Silicon Valley CISO Investment Group (SVCI), and Matt Hilary, the Vice President of Security and CISO at Drata.